User authentication is typically required when a user conducts a transaction using a debit/credit card or seeks access to network-based services that store or have access to information that is personnel and/or warrants protection from unauthorized access by others (e.g., an online or mobile banking service or the like). User authentication serves to validate that the individual conducting the transaction is the individual authorized to use the debit/credit card account or that the individual seeking access to the network-based service is the individual authorized to access the service. Typically, a user provides authentication credentials, otherwise referred to herein as authentication requirements, (e.g., a user ID and password), which are then compared to the user's securely stored authentication credentials and, if the authentication credentials provided by the user match the stored authentication credentials, the user is allowed to conduct the transaction or gain access to the network-based service.
In many instances, a burden is placed on the user providing the authentication requirements. Specifically, the user must remember their authentication credential or, in the event that the user forgets the authentication credentials undertake a procedure to recover the authentication credentials. Remembering the authentication credentials can become problematic if the user does not use the network service and/or conduct such transactions frequently or if the user is required to change their authentication credentials periodically in order to insure their security. In addition to problems associated with remembering authentication credentials, the mere process of entering such authentication credentials either at a point-of-sale (POS) location or at a gateway to network service entry can be a burdensome and risky endeavor. In some instances, entry of such authentication credentials can be an inefficient and time-consuming process. For example, if the user is implementing a handheld mobile device, such as smart cellular telephone or the like, to gain access to a network-based service, entry of the authentication credentials on the device requires the ability of the user to see the display and accurately enter the credentials via the downsized keypad. If the authentication credentials require different case lettering and/or non-alphanumeric characters for security purposes entry becomes even more daunting and prone to entry errors. Moreover, if the user repeatedly enters the authentication incorrectly, the network-service may see this as a security risk and bar the user from further attempts, thereby denying the user entry to the network-service.
In addition to user inefficiency problems, entering authentication credentials in a public setting, such as a POS location or via a mobile device, presents risks that the authentication credentials may be nefariously intercepted by someone in the vicinity.
In today's computing networking environments, especially in the mobile or wireless realm, the entity that provides the network service or the authenticating entity may have instantaneous availability to other information, besides the user-provided authentication credentials, which can serve to at least assist in validating the identity of the user. Therefore, a need exists to develop other methods, apparatus and computer program products for user authentication. The desired methods, apparatus and computer program products for user authentication should alleviate problems associated with inefficiencies in the current user authentication process and/or add additional security to the user authentication process. Further, the desired methods, apparatus and computer program products should leverage other information that the authenticating entity knows about the user at the time of the authentication request to assist in the authentication process. In this regard, the other information known about the user may serve to adjust the authentication requirements/credentials that the user must provide to gain access or, in some instances, eliminate the need for the user to provide authentication requirements/credentials.